Online security and password management

This post is a bit off topic from what I usually write about. I want to take look at a something that is increasingly becoming an issue - being secure online. The internet is an essential utility that one cannot avoid. As such it’s more important than ever to have good security hygiene.

Background

Wired journalist Mat Honan was recently hacked hard. Hackers gained access to his Apple iCloud, Twitter and Google accounts. They posted some vile comments via his Twitter, deleted his Google account, and wiped his iPhone, iPad and MacBook Air. His MacBook air was the only place he had more than a year’s worth of photos, covering the entire lifespan of his daughter. (He's since recovered his data, at a cost of about $1500.) Really, he was lucky in that they did this for the “lulz”, not to gain access to a bank account or steal his identity.

There is no such thing as perfect security when online, but you can take steps to be more secure. Before looking at solutions, let's consider the issues.

Authenticating yourself involves providing evidence that you are you. You can prove who you are through:

• something you are (e.g. a finger print)
• something you know (e.g. a password)
• something you have (e.g. a mobile phone).

Logging on to a website generally uses "something you know" - a password. The problem with this is that this is inherently insecure. If a hacker gains access to your password - game over.

I've spent a fair bit of time getting secure as reasonable. The main ways of doing this are:

1. Using strong passwords
2. Two factor authentication

This post will take you through some apps that make it easy to do this with hopefully not too much effort. It is more effort than not being secure, but much less effort than trying to recover a destroyed digital life, or worse, a stolen identity.

What to not do

Most people use terrible passwords. The most common passwords are:

1. password
2. 123456
3. 12345678
4. 1234
5. qwerty
6. 12345
7. dragon
8. pussy
9. baseball
10. football
11. letmein
12. monkey
13. 696969
14. abc123
15. mustang
16. michael
17. shadow
18. master
19. jennifer
20. 111111
21. 2000
22. jordan
23. superman
24. harley
25. 1234567

If one of yours is here... sheesh. (And one assumes number 8 is referring to the popular house pet.)

Some basics of things you shouldn't do. Do not use:

• personal information in your password that someone could work out
• dictionary words, or geographical or biographical names
• a password that is the same as your account information.

If you think you're okay because you use an "un-guessable" password of your own, think again. If your password isn't actually random, then it's getting worse over time. Every time a password database is leaked, hackers get a better idea of the patterns that people use, as this great article explains. Other points:

• The average Web user maintains 25 separate accounts but uses just 6.5 passwords to protect them.
• In the past year alone more than 100 million passwords have been published online.
• 8.2 billion average passwords combinations per second are able to be tried by a PC running a single AMD Radeon HD7970 GPU.

Passwords people think are secure follow patterns that hackers have cracked. E.g:

• Adding numbers or non-alphanumeric characters such as "!!!" to them, usually at the end, but sometimes at the beginning.
• "Mangling" — transforming words such as "super" or "princess" into "sup34" and "prince$$".
• Mirror imaging — "book" becomes "bookkoob" and "password" becomes "passworddrowssap".
• Appending a date of birth or similar to a name — Julia1984.

The bottom line is you're not really that clever or original. Any pattern you thought of using, someone else has probably thought of using it too, and at some stage a password database leak has enabled hackers to add that pattern to the lists of passwords they cycle through.

How to create a strong password

The fundamentals of making a password strong are:

1. A bigger set of characters: numbers only (10 characters), numbers + lowercase + uppercase letters (10 + 26 + 26 = 62 characters), all the characters on your keyboard (92).
2. The longer the better. Longer means exponentially more possible combinations an attacker has to try. A four character password would take about 0.0004 seconds to crack. A 10 character one would take about a year.
3. Increase entropy. Use random characters for your passwords.